Hi!
I don't know whether krpano uses flash's built-in http or a raw socket. First try the allowdomain.domain in
http://krpano.com/docu/xml/#security to give permission to xyz.s3.amazonaws.com .
If it doesn't work, raw sockets in flash will only connect to a domain different from that in which the swf is hosted if the target domain is able to provide a cross-domain policy xml file which explicitly grants the source domain permission to connect. Look into the actionscript 3 documentation to find out how to create this file, then you must be able to make it acessible from
http://xyz.s3.amazonaws.com/crossdomain.xml or set a different path using the crossdomainxml.url in
http://krpano.com/docu/xml/#security (must be in the same domain).